Xorg: xwayland: use-after-free in playreleasedevents()

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

Xorg: xwayland: heap overflow in xkbwritekeysyms()

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

X.org: xwayland: use-after-free of the root cursor

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

Gcc: libstdc++ integer overflow in `new` operator

Glib: integer overflow in in g_escape_uri_string()

Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

Bluez: stack overflow in name2utf8 causes dos and potential code execution

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow

Grub2: net: out-of-bounds write in grub_net_search_config_file()

Spice-server: spice: heap oob read/write via unchecked migration data offsets

Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Cockpit: cockpit: denial of service via unbounded connection thread spawning

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

Pcp: pcp: denial of service due to signed integer overflow

Libssh: libssh: use-after-free via data callbacks on closed channels

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module